To ensure that organizations are compliant with laws, regulations, other mandates, policies, and procedures (“guidelines”), it is critical to demonstrate how organizations can meet those expectations. Although these guidelines can provide a roadmap and a sense of direction for employees to follow and comply with, inefficiencies can lead to inconsistencies.
For this reason, compliance professionals need to proactively emphasize the importance of PoP—policy on policies—with relevant stakeholders before lack of accountability and enforcement becomes problematic. The first element of an effective compliance program begins with written policies, procedures, and standards of conduct to mitigate and reduce organizational compliance risks. As stated in the newly published U.S. Department of Health and Human Services (HHS) Office of Inspector General (OIG) Compliance Program Guidance (CPG):
Having policy and procedure documents that are not up to date diminishes their credibility to the users of such policies and procedures and other interested parties, including Government regulators. Inaccurate or unreliable policies and procedures also reduce the compliance program’s authority, credibility, and effectiveness at the entity.[1]
The U.S. Department of Justice (DOJ) expectations are clear:
-
Have a process for implementing compliance policies and procedures. In other words, a PoP that sets the tone by laying out a framework and foundation.
-
Ensure enforceability. For consistency, equitability, and fairness—outlining the consequences of not adhering to a policy can demonstrate that the organization disciplines employees who fail to comply with explicitly stated requirements. (Note: Auditors would like to see how this is enforced through tracking and documentation.)
-
Proper communication. Timely notices when there is a policy change, whether newly implemented or retired. Communicate with key committees (including third parties when applicable) and document the update in the meeting minutes as well as in an email for your records.
-
Record retention. Implementing proper and secure record retention, management, and archival procedures will greatly reduce liability and is a best practice.
If a PoP is not required, why is it relevant?
A PoP outlines vital roles and responsibilities during the policy life cycle. Although it is not necessarily a requirement for organizations to have, the benefits of having one far outweigh the alternatives. With effective policy guidance, compliance professionals are better equipped to address the challenges regulating policy governance while maintaining consistent development and review processes. Simply put, if there is policy compliance, there are consistent operations.
DOJ’s recent enforcement guidance Evaluation of Corporate Compliance Programs compiled a useful set of questions to guide prosecutors when assessing whether the organization has sound policies and procedures established pertaining to the design, comprehensiveness, accessibility, operational integration, and most importantly—policy gatekeepers.[2] This most recent DOJ guidance primarily focuses on a compliance program’s outcomes. In other words, is the compliance program working? Consequently, it is no longer sufficient to merely have policies and procedures. Instead, DOJ’s guidance underscores the importance of focusing on the effectiveness of organizational policies and procedures.
In addition to the expectations listed previously, DOJ provided questions to further guide auditors. One of the questions is, “What (if any) guidance and training has been provided to key gatekeepers in the control processes (e.g., those with approval authority or certification responsibilities)?”
